Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sramiz
sramiz
Path Finder
Member since:
05-01-2014
02-20-2021
Community Statistics
| Posts | 22 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 6 |
| Member Since | 05-01-2014 |
Activity Feed
- Got Karma for Re: CMMaster - Unable to send scheduled jobs. 02-14-2021 08:28 PM
- Karma Re: CMMaster - Unable to send scheduled jobs for martinbistrom. 02-14-2021 07:54 PM
- Posted Re: CMMaster - Unable to send scheduled jobs on Splunk Enterprise. 02-14-2021 07:53 PM
- Karma Re: configuring a receiver - cluster master for scelikok. 02-12-2021 03:20 AM
- Posted Re: configuring a receiver - cluster master on Getting Data In. 02-08-2021 02:16 PM
- Posted configuring a receiver - cluster master on Getting Data In. 02-08-2021 02:00 PM
- Got Karma for Re: CMMaster - Unable to send scheduled jobs. 01-25-2021 02:03 AM
- Got Karma for Re: CMMaster - Unable to send scheduled jobs. 01-21-2021 12:17 PM
- Got Karma for Re: CMMaster - Unable to send scheduled jobs. 01-14-2021 04:34 AM
- Posted Re: CMMaster - Unable to send scheduled jobs on Splunk Enterprise. 01-14-2021 03:39 AM
- Got Karma for Re: CMMaster - Unable to send scheduled jobs. 01-12-2021 12:23 AM
- Posted Re: CMMaster - Unable to send scheduled jobs on Splunk Enterprise. 01-11-2021 06:00 AM
- Posted Re: ignore old logs control from indexer cluster on Installation. 12-31-2020 06:08 AM
- Posted CM splunkd.log getting filled up with WARNING messages on Installation. 12-30-2020 06:46 AM
- Tagged CM splunkd.log getting filled up with WARNING messages on Installation. 12-30-2020 06:46 AM
- Tagged CM splunkd.log getting filled up with WARNING messages on Installation. 12-30-2020 06:46 AM
- Tagged CM splunkd.log getting filled up with WARNING messages on Installation. 12-30-2020 06:46 AM
- Posted Re: CMMaster - Unable to send scheduled jobs on Splunk Enterprise. 12-29-2020 08:39 AM
- Posted ignore old logs control from indexer cluster on Installation. 12-27-2020 06:06 PM
- Posted Re: Can't write file "/root/.splunk/ on Installation. 11-03-2020 08:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-14-2021
07:53 PM
1 Karma
thats correct. Issue is gone after updating to 81.2
... View more
02-08-2021
02:16 PM
@scelikok Thanks for your prompt message. I am new to using splunk and have another dumb question to ask. first step is to install SF on servers than configure to use DS and than push the settings (outputs.conf) using DF, right?
... View more
02-08-2021
02:00 PM
hi, we have following setup 1 cluster master, 3 indexers, 1 deployement server, 3 search heads, 1 Heavy forwarder and more than 200 potential splunk forwarder servers (linux and windows) Plans is to share outputs.conf with those servers owners so they can install and configure SF on their servers and use this outputs.conf file. The outputs.conf that I created during POC looks like this: [indexer_discovery:poc-cluster-master]
pass4SymmKey = {password value}
master_uri = https://poc-cluster-master:8089
[tcpout:poc-clustermastergroup]
autoLBFrequency = 30
forceTimebasedAutoLB = true
indexerDiscovery = poc-cluster-master
useACK = true
[tcpout]
defaultGroup = poc-clustermastergroup The {dumb} questions i have that how can I share this file with everyone without sharing {password value}. is this password could be anything or needs to be same as CM admin password and if its than Is there a better way of deploying SF on all servers without sharing this password? puppet? Any tweak or suggestion to make this stanza better (not necessarily prettier) performance wise. regards, SR
... View more
Labels
- Labels:
-
universal forwarder
01-14-2021
03:39 AM
3 Karma
So yeah, splunk support says its a known bug. Most likely will be fixed in next release. its non impacting error but if its annoying than downgrade your splunk to 8.0. Here's the snippet from my support ticket. I have been checking this issue with a couple of colleagues and it seems you are hitting a known bug that we have internally which is the SPL-197830 we are still working on a solution for that and it's currently high priority, however, it seems that the resolution will come out on version 8.1.2. According to the notes of the internal case the "errors" are false positives, so there isn't much to worry. I know you are getting flooded with the errors and a temporarily solution could be do downgrade to a version 8.0.X. We haven't seeing that error on that version yet but currently that is our best option. If you are planning to wait, I will suggest you to call to Splunk Hot line and ask for the internal case SPL-197830 just to make sure everything was fixed. Regards SR
... View more
01-11-2021
06:00 AM
1 Karma
Hello, I have opened up a case with splunk and support team asked me to upgrade my splunk version to 8.1.1, but as you noticed it too, it didn't work. I am waiting to hear from splunk on next steps. regards, SR
... View more
12-31-2020
06:08 AM
hi @scelikok Thanks for your reply but its not about deleting index or retention period. I want to know if there is a way for UF to ignore any logs that are older than 30 days and if this setting can in place from indexer cluster not in UF's inputs.conf. thanks again
... View more
12-30-2020
06:46 AM
hi guys, getting spammed by these messages in splunkd.log. any idea what this is about and how to stop them. have two separate but identical environments and both CM splunkd.log getting filled up with these messages. Tried restarting whole stack but didn't help. version is 8.1.0 12-30-2020 09:42:54.404 -0500 WARN Fixup - GenCommitFixup::finish error in scheduler sendQueued= 12-30-2020 09:42:54.404 -0500 WARN CMMaster - Unable to send scheduled jobs, err="" 12-30-2020 09:42:54.904 -0500 WARN Fixup - GenCommitFixup::finish error in scheduler sendQueued= 12-30-2020 09:42:54.904 -0500 WARN CMMaster - Unable to send scheduled jobs, err="" 12-30-2020 09:42:55.405 -0500 WARN Fixup - GenCommitFixup::finish error in scheduler sendQueued= 12-30-2020 09:42:55.405 -0500 WARN CMMaster - Unable to send scheduled jobs, err="" 12-30-2020 09:42:55.904 -0500 WARN Fixup - GenCommitFixup::finish error in scheduler sendQueued= 12-30-2020 09:42:55.905 -0500 WARN CMMaster - Unable to send scheduled jobs, err="" 12-30-2020 09:42:56.405 -0500 WARN Fixup - GenCommitFixup::finish error in scheduler sendQueued= 12-30-2020 09:42:56.405 -0500 WARN CMMaster - Unable to send scheduled jobs, err="" 12-30-2020 09:42:56.905 -0500 WARN Fixup - GenCommitFixup::finish error in scheduler sendQueued= 12-30-2020 09:42:56.905 -0500 WARN CMMaster - Unable to send scheduled jobs, err="" 12-30-2020 09:42:57.406 -0500 WARN Fixup - GenCommitFixup::finish error in scheduler sendQueued= 12-30-2020 09:42:57.406 -0500 WARN CMMaster - Unable to send scheduled jobs, err=""
... View more
12-27-2020
06:06 PM
Hello, We are running 3 SH and 3 indexers cluster. wondering how can we restrict indexers to ignore logs older than 30 days? I understand that it can be managed on UF inputs.conf by using ignoreOlderThan but is there a way to control this from indexers cluster level settings? Note: sorry for a basic question but I am a beginner in splunking thanks SR
... View more
Labels
- Labels:
-
indexer
11-03-2020
08:05 AM
Thats correct. it worked for me when I used splunk command as splunk user without sudo. thanks
... View more
11-02-2020
08:37 AM
Hello, Splunk version is 8.0.6. trying to configure searchHead to connect to deployer. running following command but getting an error. sudo /opt/splunk/bin/splunk init shcluster-config -auth admin:password1 -mgmt_uri https://10.31.0.28:8089 -replication_port 9000 -replication_factor 3 -conf_deploy_fetch_url http://10.31.0.33:8089 -secret password1 -shcluster_label stg-shcluster1 Can't write file "/root/.splunk/authToken_hostname1_8089": Permission denied splunk is running as a splunk user and have configured boot-start in systemd Note: 1. I have read previous posts about similar error but their case is different than mine, i am not starting or have not started splunk as root user. 2. I have already added /opt/splunk/bin/splunk command in /etc/sudoers file to allow splunk user. any suggestions? regards, SR
... View more
Labels
- Labels:
-
splunkd
03-29-2020
11:04 AM
thank you for clarification
... View more
03-28-2020
01:13 PM
hello,
We have one searchhead and one indexer server running on separate VMs. wondering where should we install website monitoring application? any tip or advise is much appreciated.
regards,
SR
... View more
06-07-2016
10:04 PM
<formatter className="com.dtdsoftware.splunk.formatter.TokenizedMBeanNameQuotesStrippedFormatter" />
<!-- cluster example, many JVMs that have the same MBeans can be conveniently grouped together -->
<cluster name="IDM_QAC" description="A cluster of IDM APPS in QAC">
<!-- Mbeans common to all cluster members -->
<mbean domain="java.lang" properties="type=Memory">
<attribute name="HeapMemoryUsage:used" outputname="heapUsed"/>
<attribute name="HeapMemoryUsage:max" outputname="heapMax"/>
</mbean>
<!-- cluster members with many examples of connecting to JMX Servers -->
<jmxserver host="devrha11" jvmDescription="QAC_OAM1" jmxport="9001"/>
<jmxserver host="devrha12" jvmDescription="QAC_OAM2" jmxport="9001"/>
<jmxserver host="devrha15" jvmDescription="QAC_OIM1" jmxport="9001"/>
<jmxserver host="devrha16" jvmDescription="QAC_OIM2" jmxport="9001"/>
<jmxserver host="devrha50" jvmDescription="QAC_OVD1" jmxport="9001"/>
<jmxserver host="devrha51" jvmDescription="QAC_OVD1" jmxport="9001"/>
</jmxserver>
</cluster>
</jmxpoller>enter code here
... View more
06-07-2016
02:46 PM
Blockquote
Blockquote
... View more
06-07-2016
12:49 PM
Hi Damien
Using your example cluster file .. still getting an error. Any suggestion?
validation failed: "cluster" must be terminated by the matching end-tag
... View more
07-02-2015
12:02 PM
hello.
whats the correct syntax of adding multple JVM instances in config.xml or its one config per jvm ( i doubt it though).
here's what my config.xml looks like
<jmxserver host="devappa40" jvmDescription="Dev_Portal" jmxport="5002">
<jmxserver host="devappb12" jvmDescription="Dev_Switch" jmxport="9192">
I can see the first host but not the 2nd one.
any help is appreciated...
... View more
07-02-2015
07:29 AM
1 Karma
worked... thanks a lot Iguinn and fdi01... I got it working with the combination of your suggested solution.... thanks again..
cheers
SR
... View more
07-01-2015
02:06 PM
thanks for you suggestion.... it worked partially as i can see some files in spunk but not all of the them...
my inputs.conf looks like
[monitor:///server/default/logs/_problems_.log*]
disabled = false
sourcetype = log4j
index = test
[monitor:///server/default/logs/_full_.log*]
disabled = false
sourcetype = log4j
index = test
[monitor:///server/default/logs/schema.log*]
disabled = false
sourcetype = log4j
index = test
[monitor:///server/default/logs/errors.log*]
disabled = false
sourcetype = log4j
index = test
also what if files have date added to their names... an example
-rw-rw-r-- 1 app1 grp1 30154 Jun 15 20:10 _problems_.log.2015-06-15
-rw-rw-r-- 1 app1 grp1 665785 Jun 15 20:10 _full_.log.2015-06-15
-rw-rw-r-- 1 app1 grp1 0 Jun 16 00:00 caf.log.2015-06-16
-rw-rw-r-- 1 app1 grp1 24335 Jun 16 22:45 _problems_.log.2015-06-16
-rw-rw-r-- 1 app1 grp1 622448 Jun 16 22:45 _full_.log.2015-06-16
-rw-rw-r-- 1 app1 grp1 0 Jun 17 00:00 caf.log.2015-06-17
-rw-rw-r-- 1 app1 grp1 682876 Jun 17 00:13 2015_06_16.request.log
-rw-rw-r-- 1 app1 grp1 5511792 Jun 17 17:02 2015_06_17.request.log
-rw-rw-r-- 1 app1 grp1 26474 Jun 17 22:20 _problems_.log.2015-06-17
-rw-rw-r-- 1 app1 grp1 870503 Jun 17 22:20 _full_.log.2015-06-17
-rw-rw-r-- 1 app1 grp1 0 Jun 18 00:00 caf.log.2015-06-18
... View more
06-25-2015
10:31 AM
Hello,
I have a question about indexing multiple types of logs file in same folder. How would go about defining sourcetypes correctly to these files using inputs.conf
for an example:
../local/application/logs/ contains
server.log (sourcetype=log4j)
audit.log (sourcetype=log4j)
_problems.log (sourcetype=log4j)
errors.log (sourcetype=log4j)
YYYY_MM_DD.request.log (sourcetype=access_combined)
Thanks
Ramiz
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-20-2021
02:07 PM
|
